From: Ian Jackson Date: Wed, 5 Sep 2012 11:27:25 +0000 (+0100) Subject: xen: prevent a 64 bit guest setting reserved bits in DR7 X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~7990 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=e89c6d05737c46f4ebee1f02138acf1cb1a48291;p=xen.git xen: prevent a 64 bit guest setting reserved bits in DR7 The upper 32 bits of this register are reserved and should be written as zero. This is XSA-12 / CVE-2012-3494 Signed-off-by: Jan Beulich Reviewed-by: Ian Campbell --- diff --git a/xen/include/asm-x86/debugreg.h b/xen/include/asm-x86/debugreg.h index 9b7e9717cb..24021b8734 100644 --- a/xen/include/asm-x86/debugreg.h +++ b/xen/include/asm-x86/debugreg.h @@ -58,7 +58,7 @@ We can slow the instruction pipeline for instructions coming via the gdt or the ldt if we want to. I am not sure why this is an advantage */ -#define DR_CONTROL_RESERVED_ZERO (0x0000d800ul) /* Reserved, read as zero */ +#define DR_CONTROL_RESERVED_ZERO (~0xffff27fful) /* Reserved, read as zero */ #define DR_CONTROL_RESERVED_ONE (0x00000400ul) /* Reserved, read as one */ #define DR_LOCAL_EXACT_ENABLE (0x00000100ul) /* Local exact enable */ #define DR_GLOBAL_EXACT_ENABLE (0x00000200ul) /* Global exact enable */